Why the choice of ITAD company matters
Selecting the wrong ITAD company is not merely an inconvenience — it can expose your organisation to regulatory enforcement. Under UK GDPR and the Data Protection Act 2018, you remain legally responsible for personal data on retired devices until you can prove it has been destroyed. If an unqualified provider fails to wipe a hard drive and that data later resurfaces, the ICO may hold your organisation accountable, not the provider.
Similarly, under the WEEE Regulations 2013, your duty of care for waste electrical and electronic equipment does not end when a carrier collects it. If that carrier is not properly licensed, your organisation may face enforcement from the Environment Agency.
Choosing a properly certified ITAD company is the only way to transfer these risks effectively. For background on what the service covers, see our guide on what ITAD is and how it works.
What certifications should an ITAD company hold?
These are the credentials to verify before signing a contract with any UK ITAD provider:
| Certification / Registration | Issuing body | What it confirms |
|---|---|---|
| Environment Agency waste carrier licence | Environment Agency | Legal authority to transport WEEE on public roads |
| Authorised Treatment Facility (AATF) status | Environment Agency | Permission to process WEEE at their facility |
| ADISA certification | Asset Disposal and Information Security Alliance | Independently audited data destruction processes |
| ISO 27001 | BSI / accredited certification body | Information security management system |
| ISO 14001 | BSI / accredited certification body | Environmental management system |
| ICO registration (data processor) | Information Commissioner’s Office | Registered to process personal data on your behalf |
You can verify Environment Agency permits through the public register on gov.uk. ADISA certification can be confirmed on the ADISA website. ICO registration is searchable at ico.org.uk/ESDWebPages/Search.
Do not accept a provider’s assurances at face value. Ask to see their licence numbers and check them.
What questions should you ask a prospective ITAD company?
Before committing, put these questions to any provider:
On data destruction:
– What standards do you use for data wiping (NIST 800-88, HMG Infosec Standard 5)?
– Do you issue individual data destruction certificates per device?
– What happens to drives that cannot be wiped — are they physically shredded on-site or off-site?
On chain of custody:
– How do you log assets from collection to final destination?
– Will I receive a manifest of every device collected, including serial numbers?
On recycling:
– Which authorised treatment facilities do you use?
– Do you supply a waste transfer note as required under the Environmental Protection Act 1990?
On resale:
– If devices are remarketed, how do you ensure data has been wiped before resale?
– Do I receive any financial return from devices that are sold?
On social impact:
– Do you offer donation pathways for functional devices?
What red flags should you watch for?
Be cautious of ITAD companies that:
- Cannot provide a valid Environment Agency waste carrier licence number
- Offer data destruction without issuing certificates
- Are unwilling to disclose which recycling facilities they use
- Promise collection “for free” with no explanation of where revenue comes from — devices may be resold without proper data wiping
- Lack any ISO or ADISA certification for data security
A provider that cannot answer questions about their certifications transparently is not a provider you should trust with your data.
Should you choose a local or national ITAD company?
Both can be appropriate, depending on your needs.
A national provider may be preferable for multi-site or high-volume projects, where scale and logistics infrastructure matter. A London-based provider such as Recycle4Charity will typically offer faster response times for London offices and a more personal account relationship. Local providers also often have stronger community ties — our refurbishment programme gives devices to digitally-excluded Londoners, which is something a large national operation rarely does.
For smaller businesses with a single office, a local certified provider is often the most cost-effective and responsive option. Read our guide on secure IT disposal for small businesses for considerations specific to smaller organisations.
How to compare quotes from ITAD companies
When comparing proposals, look beyond the headline price. Ask each provider to break down:
- Collection and logistics costs
- Data destruction costs (per device or per project)
- Resale credit or revenue share on remarketed devices
- Recycling fees for non-resaleable equipment
- Certification and reporting costs
A provider offering a very low price may be cutting corners on data destruction, using unlicensed recycling routes, or reselling devices without adequate wiping. Our guide to IT asset disposal costs in the UK explains what drives pricing and what a reasonable fee structure looks like.
Ready to choose?
Recycle4Charity operates across London and the South East, holds the relevant certifications and publishes its processes transparently. We give every reusable device a second life in the community before anything is recycled. Visit our business services page to request a quote or arrange a collection.